If your team is preparing for ISO 42001, start by organizing the people, AI use cases, decisions, and evidence in scope. This guide offers a preparation workflow; use your confirmed requirement set for the detailed assessment. AI management planning also benefits from will an auditor trust AI-assisted compliance work and the cross-border lens in multi-jurisdiction compliance.
Quick Answer
ISO 42001 preparation starts with AI inventory, scope, roles, policy, risk review, and evidence planning. Keep legal applicability, customer commitments, and assessment planning separate.
Define the work before drafting policies
Write a preparation brief. Record why the organization is pursuing the work, which AI activities it covers, who owns the program, and what outcome leadership expects.
Confirm the version and scope with the person responsible for interpreting the requirements. Keep unanswered questions visible rather than filling them with assumptions.
Organize the work around inventory, ownership, risk review, data handling, oversight, and change records. Adapt that structure to the requirements your team has confirmed.
Bring the right owners into preparation
List the teams that build, procure, configure, or use AI within the proposed scope. Identify who can explain each system and approve decisions about its use.
Invite representatives based on their role in the work:
- Product and engineering owners: explain intended use, deployment, testing, and changes.
- Operational users: explain how outputs affect real decisions and where review occurs.
- Security, privacy, and legal owners: resolve handling and obligation questions.
- Leadership sponsors: approve priorities, resources, and accountability.
Ask the responsible legal and commercial owners to confirm any contractual or regulatory expectations separately. Do not assume that a assessment plan settles those questions.
Record decisions in a shared approval log with the rationale, supporting material, owner, and review date.
How ISO 42001 relates to your ISO 27001 program
If you already have an ISO 27001 program, inventory the governance routines and records available for possible reuse. Check their relevance to the AI activities in scope before accepting them.
Use cross-framework evidence reuse as a planning approach, then validate the actual mappings.
Review AI-specific questions with the relevant owners: intended use, affected users, data inputs, output checks, failure handling, and changes after deployment.
Keep assessment preparation and legal applicability reviews as separate workstreams with named owners. Reconcile their action lists without assuming one substitutes for the other.
| Workstream | Practical record |
|---|---|
| Preparation scope | Included AI activities, systems, and owners |
| Requirement review | Confirmed references and interpretation questions |
| Risk review | Decisions, treatments, and supporting evidence |
| Operational oversight | Output checks, escalation, and change records |
| Legal and contractual review | Confirmed obligations and assigned actions |
Agree on the assessment plan
Before scheduling an assessment, confirm the provider’s scope, credentials, proposed process, deliverables, and commercial terms.
Ask what your team needs to prepare, which records will be reviewed, and how unresolved issues will be handled. Document the answers.
Assign owners to preparation tasks and agree on an internal review before the assessment. Include time to verify evidence and resolve questions.
Use source records to support statements about governance. For review practice, see AI-assisted work in an audit.
How to start preparing for ISO 42001
Start by writing down each AI system you develop or use and who owns it. That AI inventory drives the downstream work: policy, risk assessment, oversight, and evidence collection all key off it.
- Build the inventory. Include AI features buried inside tools you already own, not just the obvious platforms. Ownership matters as much as the list itself.
- Write the AI policy. A short, leadership-approved statement of how the organization develops, provides, or uses AI, with objectives you can point to later.
- Assess AI risk. Evaluate each system for the risks it creates, then record the treatment you chose. Written records, kept current.
- Keep humans accountable. Oversight arrangements should make clear who approves AI output before it affects a customer, a control, or a report. Human-in-the-loop design is where that gets concrete.
- Collect evidence as you go. Policies, risk records, review minutes, and change history. Retroactive documentation is the expensive kind.
- Run an internal review first. Treat it like a pre-audit. Assign and verify corrective actions before relying on the result.
Two habits separate teams that reach a certifiable state from teams that stall. The first is treating the inventory as a living document; AI features arrive through ordinary tool purchases, and an inventory frozen at the kickoff meeting is wrong within a quarter. The second is assigning ownership to named people rather than departments, because "the compliance team" reviews nothing when the review matters.
Set the plan based on your scope and available resources. Do not treat a completed checklist as an assurance of assessment outcome or effective governance.
FAQ
How should we decide whether to pursue an assessment? Record customer requests, leadership objectives, costs, and confirmed obligations. Have the accountable owners approve the decision and intended scope.
What should we ask an assessment provider? Confirm scope, credentials, process, evidence expectations, deliverables, availability, and terms before committing to a schedule.
Can we reuse an existing security program? Review its records and workflows for relevance. Reuse only what fits the AI scope and confirm the remaining gaps.
How do we include AI used inside the business? Inventory the use cases, owners, inputs, outputs, and review steps. Ask the scope owner which activities to include in preparation.
How should we handle legal questions? Assign them to the responsible legal or compliance owner. Record the confirmed requirements separately and connect any resulting actions to the preparation plan.
Where CASK fits
<a href="https://www.truvara.ai/">CASK</a> can help draft inventory summaries, policy sections, and risk-review records from material you provide. Check the sources, confirm the scope, and have a person approve the work.
Use CASK to support drafting and review while your team retains responsibility for the preparation plan and decisions. Try CASK now.